Supermarket chains including Ahold Delhaize, Colruyt, Carrefour, ICA, Coop and SuperValu across Europe were hit on Monday by cyberattacks that raised freezer temperatures and spoiled food.
An overnight information technology incident affected refrigerators and freezers at dozens of Ahold Delhaize and Colruyt stores in Belgium and Luxembourg on November 2. The Swedish chains ICA and Coop, along with grocers in Ireland and Estonia, reported similar temperature spikes.
Ahold Delhaize, a Dutch-Belgian retail group formed by the 2016 merger of Ahold and Delhaize, and Belgian grocer Colruyt Group both operate hundreds of supermarkets across the Benelux region, relying on networked cooling systems to preserve perishable food.
Overnight freezer failures in Sweden and Estonia
In Sweden, staff arriving for morning shifts found that commercial freezers had been turned into heated cabinets overnight. Engla Ingwall, sales manager at a franchised ICA store in Stockholm, told Reuters that a cyberattack had pushed all of the shop's freezers to 50 degrees Celsius.
Ingwall said the attack occurred at 2 a.m. local time on Monday, but was only noticed hours later, adding that everything inside the units was destroyed.
An ICA spokesperson said in an emailed statement that the company was aware a limited number of stores had been affected by an overnight incident that impacted their refrigeration and freezing systems. Headquartered in Stockholm, ICA is one of the largest grocery retailers in the Nordic region.
Privately held supermarket group Coop told the Swedish newspaper Aftonbladet that six of its stores were affected by similar incidents. The company did not immediately respond to a request for comment.
An Estonian supermarket chain was also affected, with temperatures reaching 50 degrees Celsius, the technology provider Kitman Coldtech told Estonia's public broadcaster ERR.
Defrost mode attacks on Belgian and Irish stores
In Belgium, Stephan Moelans, chief executive officer of the Belgian refrigeration company Sabcobel, which operates the systems for Delhaize, told the Belga news agency that the incident was a cyberattack in which the units' evaporators were placed into defrost mode.
Moelans told Belga that he had been awake since 2 a.m. and that staff had worked through the night and all morning to disconnect the affected units from the network. Moelans's office declined to comment.
In commercial refrigeration, evaporator coils absorb heat to keep freezers well below zero, while automated defrost cycles warm the coils to melt away ice. Forcing an evaporator to stay in defrost mode stops cooling and heats the cabinet.
French supermarket chain Carrefour said 15 of its 700 stores in Belgium were affected. A spokesperson for Colruyt Group, which operates Spar stores in Belgium under a franchise system, said five stores had their refrigeration systems attacked.
In Ireland, food distributor Musgrave reported that a cyber incident affected the refrigeration systems at 13 of its SuperValu stores, forcing it to remove some chilled and frozen products from sale. Musgrave, Ireland's largest grocery distributor, said in a statement that its monitoring systems had alerted it to the problem, that it had taken immediate action, and that its investigation was ongoing.
Spoiled meat at Belgian butcher shops
Independent food retailers were also hit. Luc De Laet, founder and owner of the Belgian butcher chain De Laet & Van Haver, said an employee woke him at 3:30 a.m. local time to report a problem.
De Laet rushed to his store in Hove, south of Antwerp, and found the refrigerators at temperatures of up to 18 degrees Celsius. He said the temperature spike spoiled about 15,000 euros worth of meat.
Speaking to Reuters, De Laet said the situation was very frightening because hackers were breaking into the system that records temperatures and programming it remotely. He added that he was furious about having to throw away so much food.
De Laet said he believed the hackers were trying to destabilise European economies, and urged authorities to wake up because something was happening. He added that he had contacted the police, but did not know whether an investigation was under way.
French supermarket attacks and hybrid warfare concerns
This week's incidents follow an attack in France last month, where police said hackers took control of refrigeration units in hundreds of supermarkets, causing fires and food losses. Ahold Delhaize also reported a cybersecurity incident to police last month.
Although no one has claimed responsibility for any of the attacks, the cases have highlighted growing concern among regional authorities over the spread of hybrid attacks stemming from conflicts on Europe's borders following Russia's 2022 invasion of Ukraine.
Moscow has repeatedly denied any involvement in sabotage operations or hybrid warfare, which combines military pressure with covert cyberattacks on civilian infrastructure. Reuters was unable to determine who was behind Monday's attacks, or whether there was any link to the October attacks in France.
Operational technology risks in the retail sector
Sweden's National Cyber Security Centre, which said it could not speculate on who was behind the attacks, is working on several incidents that affected supermarkets across the country, the centre's head, John Billow, said on Monday. Billow said the agency had identified a considerable number of exposed operational technology devices in Sweden in recent weeks and had made clear the need to update or patch them.
From refrigerators and heating systems to security cameras and alarm networks, a growing range of devices that were once predominantly mechanical can now be monitored and controlled remotely, creating new opportunities for cybercriminals.
Tom Hegel, a researcher at the cybersecurity company SentinelOne, said such attacks typically involve extortion, political motivation or state-level operations, and that the absence of financial demands in the recent supermarket cases points to sabotage.
Hegel said the retail sector is an easy target because retail chains manage huge fleets of refrigeration controllers, building management systems, access control panels and point-of-sale equipment. Because supermarket profit margins are thin and products spoil within a few hours, he said, any disruption causes damage quickly and in public view.
